Add configurable base URL for OSS Index API by brianf · Pull Request #5736 · DependencyTrack/dependency-track

brianf · 2026-01-22T14:52:54Z

Summary

Adds support for configuring the OSS Index API base URL via the scanner.ossindex.base.url property. This enables users to:

Point to the new Sonatype API endpoint at https://api.guide.sonatype.com
Use corporate proxies
Point to private OSS Index instances
Use alternative endpoints for testing

Motivation

Sonatype is migrating OSS Index to a new API endpoint at https://api.guide.sonatype.com which requires new API tokens. Users need the ability to configure this endpoint before the legacy endpoint is deprecated.

Resolves #5737

Changes

Core Implementation

Added SCANNER_OSSINDEX_BASE_URL configuration property to ConfigPropertyConstants.java
Modified OssIndexAnalysisTask.java to support lazy-loading of custom base URL from configuration
Default behavior unchanged: uses https://ossindex.sonatype.org when not configured

Testing

Added testAnalyzeUsesCustomBaseUrl() test to verify custom URL configuration works
Added testGetApiBaseUrlWithDefaultValue() test for default behavior
All existing tests pass

Documentation

Updated application.properties with example configuration and migration notice
Updated docs/_docs/datasources/ossindex.md with detailed configuration instructions
Updated docs/_docs/getting-started/configuration.md with new endpoint information

Implementation Details

The implementation uses lazy-loading with caching:

Default constructor passes null to allow configuration loading
getApiBaseUrl() checks configuration on first call and caches the result
Falls back to default URL if no custom value is configured
Strips trailing slashes to avoid double-slash issues in URL construction

Testing

mvn -P enhance -Dtest=OssIndexAnalysisTaskTest test

All 9 tests pass, including the new custom URL test.

Backward Compatibility

✅ No breaking changes - default value matches current hardcoded URL
✅ Existing installations continue using public OSS Index without changes
✅ Constructor pattern preserved for testing

Commit Message Compliance

All commits follow the project's contribution guidelines:

✅ Subject lines under 50 characters
✅ Imperative mood
✅ Signed-off with DCO
✅ Body explains what and why

🤖 Generated with Claude Code

owasp-dt-bot · 2026-01-22T14:53:06Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

codacy-production · 2026-01-22T15:12:46Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.01% (target: -1.00%)	✅ 85.00% (target: 70.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`0272ae1`)	24510	19940	81.35%
Head commit (`5da1a61`)	24522 (+12)	19951 (+11)	81.36% (+0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#5736)	20	17	85.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

nscuro

Thanks! Few small corrections otherwise looks good.

docs/_docs/datasources/ossindex.md

docs/_docs/getting-started/configuration.md

src/main/resources/application.properties

src/test/java/org/dependencytrack/tasks/scanners/OssIndexAnalysisTaskTest.java

- Remove OSS Index base URL from application.properties (runtime-only) - Remove incorrect configuration.md documentation - Update ossindex.md to follow Snyk/Trivy pattern for runtime properties - Remove ineffective test with no assertions Addresses maintainer feedback on PR DependencyTrack#5736. The scanner.ossindex.base.url property is runtime-only and cannot be configured via application.properties. Updated documentation to clarify it must be set via environment variables, system properties, or the admin UI. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Adds configurable Base URL field to the OSS Index analyzer admin UI, allowing users to point to alternative OSS Index API endpoints (e.g., https://api.guide.sonatype.com). Implementation follows the established pattern from Snyk and Trivy analyzers for consistency: - Uses b-validated-input-group-form-input component - Implements required field validation with lazy evaluation - Integrates with configPropertyMixin for API communication - Property: scanner.ossindex.base.url (default: https://ossindex.sonatype.org) The Base URL field appears between Alias Sync and Username fields, maintaining logical grouping of configuration options. Related backend PR: DependencyTrack/dependency-track#5736 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Adds configurable Base URL field to the OSS Index analyzer admin UI, allowing users to point to alternative OSS Index API endpoints (e.g., https://api.guide.sonatype.com). Implementation follows the established pattern from Snyk and Trivy analyzers for consistency: - Uses b-validated-input-group-form-input component - Implements required field validation with lazy evaluation - Integrates with configPropertyMixin for API communication - Property: scanner.ossindex.base.url (default: https://ossindex.sonatype.org) The Base URL field appears between Alias Sync and Username fields, maintaining logical grouping of configuration options. Related backend PR: DependencyTrack/dependency-track#5736 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Brian Fox <brianf@sonatype.com>

This change adds the ability to override the OSS Index API base URL, allowing users to point to alternative OSS Index instances, corporate proxies, or on-premises deployments. Changes: - Added SCANNER_OSSINDEX_BASE_URL configuration property with default value https://ossindex.sonatype.org - Implemented lazy-loading getApiBaseUrl() method that reads from configuration and caches the result - Updated all OSS Index API calls to use the configurable URL - Added configuration examples to application.properties - Updated documentation in configuration.md and ossindex.md - Added test cases for custom URL configuration The implementation follows the existing pattern used by Snyk and Trivy analyzers, ensuring consistency across the codebase. The change is fully backward compatible - existing installations will continue using the public OSS Index service unless explicitly configured otherwise. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Brian Fox <brianf@sonatype.com>

The default constructor was initializing apiBaseUrl with DEFAULT_API_BASE_URL, preventing getApiBaseUrl() from reading the custom URL configuration. Changed to pass null, enabling lazy-loading from config property. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Brian Fox <brianf@sonatype.com>

Document Sonatype's migration to the new API endpoint at https://api.guide.sonatype.com which requires new API tokens. Updated examples in application.properties and documentation to reference the new endpoint. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Brian Fox <brianf@sonatype.com>

Fix incorrect documentation stating that new API tokens are required for the new api.guide.sonatype.com endpoint. Existing tokens from ossindex.sonatype.org work with both endpoints. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Brian Fox <brianf@sonatype.com>

Addresses PR feedback on DependencyTrack#5736: - Remove OSS Index base URL from application.properties (runtime-only) - Remove incorrect configuration.md documentation - Update ossindex.md to follow Snyk/Trivy pattern for runtime properties - Remove ineffective test with no assertions The scanner.ossindex.base.url property is runtime-only and cannot be configured via application.properties. Updated documentation to clarify it must be set via environment variables, system properties, or the admin UI. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Brian Fox <brianf@sonatype.com>

Removes unused static import that was left after deleting the testGetApiBaseUrlWithDefaultValue() test method. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Brian Fox <brianf@sonatype.com>

nscuro

Thanks!

brianf force-pushed the feature/configurable-ossindex-url branch 2 times, most recently from 462e1b3 to 3e73e48 Compare January 22, 2026 15:01

brianf mentioned this pull request Jan 22, 2026

Add configurable base URL for OSS Index API #5737

Closed

nscuro requested changes Jan 22, 2026

View reviewed changes

nscuro added enhancement New feature or request integration/ossindex Related to the Sonatype OSS Index integration labels Jan 22, 2026

brianf and others added 6 commits January 26, 2026 11:14

brianf force-pushed the feature/configurable-ossindex-url branch from 1d4db66 to 5da1a61 Compare January 26, 2026 16:15

This was referenced Jan 26, 2026

Add OSS Index Base URL configuration field brianf/frontend#1

Open

Add OSS Index Base URL configuration field DependencyTrack/frontend#1431

Merged

nscuro approved these changes Jan 27, 2026

View reviewed changes

nscuro added this to the 4.14.0 milestone Jan 27, 2026

nscuro merged commit 84e1feb into DependencyTrack:master Jan 27, 2026
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comments

Add configurable base URL for OSS Index API#5736

Add configurable base URL for OSS Index API#5736
nscuro merged 6 commits intoDependencyTrack:masterfrom
brianf:feature/configurable-ossindex-url

brianf commented Jan 22, 2026 •

edited

Loading

Uh oh!

owasp-dt-bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

codacy-production bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

nscuro left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nscuro left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Comments

Conversation

brianf commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Changes

Core Implementation

Testing

Documentation

Implementation Details

Testing

Backward Compatibility

Commit Message Compliance

Uh oh!

owasp-dt-bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

codacy-production bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage summary from Codacy

See diff coverage on Codacy

See your quality gate settings Change summary preferences

Uh oh!

nscuro left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nscuro left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

brianf commented Jan 22, 2026 •

edited

Loading

owasp-dt-bot commented Jan 22, 2026 •

edited

Loading

codacy-production bot commented Jan 22, 2026 •

edited

Loading